57a7167c5ba4644a67603d4f791f465560b74cbc4c7db85feb38390dcbcc92f5

Analysis

max time kernel
149s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
Size

408KB
MD5

a69f85d2d1e5658c819e6d7a247626d8
SHA1

7935f6dc087de3ce77d983723b9ffdf512082785
SHA256

57a7167c5ba4644a67603d4f791f465560b74cbc4c7db85feb38390dcbcc92f5
SHA512

f5eb2a152bde4828f435e8e1c4b6956ad738fa3ab25c8fa3efc4df488bd4070466d6dfb08a7c0aa618c15bbb4f18bee1a947c581fa543a77ef598d72a411d3f9
SSDEEP

3072:CEGh0oyl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGAldOe2MUVg3vTeKcAEciTBqr3jy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231e1-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000231d8-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023108-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000231d8-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f000000023108-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00080000000006cf-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0010000000023108-27.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00090000000006cf-31.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0011000000023108-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000a0000000006cf-39.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0012000000023108-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000b0000000006cf-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C127B07-9B25-4a8a-80C0-722FBE0898F6}\stubpath = "C:\\Windows\\{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe"	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}\stubpath = "C:\\Windows\\{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe"	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{573FEC55-1887-4673-BBB4-CA89981D4B19}\stubpath = "C:\\Windows\\{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe"	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF95203B-78CC-4363-9AC1-2D3E5371CE12}\stubpath = "C:\\Windows\\{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe"	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}\stubpath = "C:\\Windows\\{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe"	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C127B07-9B25-4a8a-80C0-722FBE0898F6}	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95B4C7F2-9A06-470f-925D-D3DEE9437C00}	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{573FEC55-1887-4673-BBB4-CA89981D4B19}	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}\stubpath = "C:\\Windows\\{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe"	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}\stubpath = "C:\\Windows\\{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe"	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}\stubpath = "C:\\Windows\\{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe"	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}\stubpath = "C:\\Windows\\{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe"	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}	{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}\stubpath = "C:\\Windows\\{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}.exe"	{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF95203B-78CC-4363-9AC1-2D3E5371CE12}	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9164AB4F-EA76-4020-8950-B47C716E85BF}	{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9164AB4F-EA76-4020-8950-B47C716E85BF}\stubpath = "C:\\Windows\\{9164AB4F-EA76-4020-8950-B47C716E85BF}.exe"	{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95B4C7F2-9A06-470f-925D-D3DEE9437C00}\stubpath = "C:\\Windows\\{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe"	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe

Executes dropped EXE 12 IoCs

pid	Process
2696	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe
1820	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe
3096	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe
2528	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe
1116	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe
1020	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe
872	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe
3880	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe
3508	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe
1592	{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe
4772	{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}.exe
4988	{9164AB4F-EA76-4020-8950-B47C716E85BF}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe
File created	C:\Windows\{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe
File created	C:\Windows\{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe
File created	C:\Windows\{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe
File created	C:\Windows\{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe
File created	C:\Windows\{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe
File created	C:\Windows\{9164AB4F-EA76-4020-8950-B47C716E85BF}.exe	{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}.exe
File created	C:\Windows\{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
File created	C:\Windows\{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe
File created	C:\Windows\{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe
File created	C:\Windows\{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe
File created	C:\Windows\{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}.exe	{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3188	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2696	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe
Token: SeIncBasePriorityPrivilege	1820	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe
Token: SeIncBasePriorityPrivilege	3096	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe
Token: SeIncBasePriorityPrivilege	2528	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe
Token: SeIncBasePriorityPrivilege	1116	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe
Token: SeIncBasePriorityPrivilege	1020	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe
Token: SeIncBasePriorityPrivilege	872	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe
Token: SeIncBasePriorityPrivilege	3880	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe
Token: SeIncBasePriorityPrivilege	3508	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe
Token: SeIncBasePriorityPrivilege	1592	{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe
Token: SeIncBasePriorityPrivilege	4772	{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 2696	3188	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	94
PID 3188 wrote to memory of 2696	3188	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	94
PID 3188 wrote to memory of 2696	3188	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	94
PID 3188 wrote to memory of 2672	3188	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	95
PID 3188 wrote to memory of 2672	3188	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	95
PID 3188 wrote to memory of 2672	3188	2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe	95
PID 2696 wrote to memory of 1820	2696	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe	96
PID 2696 wrote to memory of 1820	2696	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe	96
PID 2696 wrote to memory of 1820	2696	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe	96
PID 2696 wrote to memory of 2512	2696	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe	97
PID 2696 wrote to memory of 2512	2696	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe	97
PID 2696 wrote to memory of 2512	2696	{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe	97
PID 1820 wrote to memory of 3096	1820	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe	102
PID 1820 wrote to memory of 3096	1820	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe	102
PID 1820 wrote to memory of 3096	1820	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe	102
PID 1820 wrote to memory of 1556	1820	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe	101
PID 1820 wrote to memory of 1556	1820	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe	101
PID 1820 wrote to memory of 1556	1820	{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe	101
PID 3096 wrote to memory of 2528	3096	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe	103
PID 3096 wrote to memory of 2528	3096	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe	103
PID 3096 wrote to memory of 2528	3096	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe	103
PID 3096 wrote to memory of 3412	3096	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe	104
PID 3096 wrote to memory of 3412	3096	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe	104
PID 3096 wrote to memory of 3412	3096	{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe	104
PID 2528 wrote to memory of 1116	2528	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe	105
PID 2528 wrote to memory of 1116	2528	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe	105
PID 2528 wrote to memory of 1116	2528	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe	105
PID 2528 wrote to memory of 368	2528	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe	106
PID 2528 wrote to memory of 368	2528	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe	106
PID 2528 wrote to memory of 368	2528	{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe	106
PID 1116 wrote to memory of 1020	1116	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe	107
PID 1116 wrote to memory of 1020	1116	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe	107
PID 1116 wrote to memory of 1020	1116	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe	107
PID 1116 wrote to memory of 4228	1116	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe	108
PID 1116 wrote to memory of 4228	1116	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe	108
PID 1116 wrote to memory of 4228	1116	{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe	108
PID 1020 wrote to memory of 872	1020	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe	109
PID 1020 wrote to memory of 872	1020	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe	109
PID 1020 wrote to memory of 872	1020	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe	109
PID 1020 wrote to memory of 4928	1020	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe	110
PID 1020 wrote to memory of 4928	1020	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe	110
PID 1020 wrote to memory of 4928	1020	{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe	110
PID 872 wrote to memory of 3880	872	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe	111
PID 872 wrote to memory of 3880	872	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe	111
PID 872 wrote to memory of 3880	872	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe	111
PID 872 wrote to memory of 4084	872	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe	112
PID 872 wrote to memory of 4084	872	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe	112
PID 872 wrote to memory of 4084	872	{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe	112
PID 3880 wrote to memory of 3508	3880	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe	113
PID 3880 wrote to memory of 3508	3880	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe	113
PID 3880 wrote to memory of 3508	3880	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe	113
PID 3880 wrote to memory of 1188	3880	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe	114
PID 3880 wrote to memory of 1188	3880	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe	114
PID 3880 wrote to memory of 1188	3880	{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe	114
PID 3508 wrote to memory of 1592	3508	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe	115
PID 3508 wrote to memory of 1592	3508	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe	115
PID 3508 wrote to memory of 1592	3508	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe	115
PID 3508 wrote to memory of 4648	3508	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe	116
PID 3508 wrote to memory of 4648	3508	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe	116
PID 3508 wrote to memory of 4648	3508	{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe	116
PID 1592 wrote to memory of 4772	1592	{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe	117
PID 1592 wrote to memory of 4772	1592	{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe	117
PID 1592 wrote to memory of 4772	1592	{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe	117
PID 1592 wrote to memory of 5096	1592	{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe	118

C:\Users\Admin\AppData\Local\Temp\2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_a69f85d2d1e5658c819e6d7a247626d8_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe
  C:\Windows\{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe
    C:\Windows\{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{CF952~1.EXE > nul
      4⤵
      PID:1556
  - - C:\Windows\{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe
      C:\Windows\{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3096
    - - C:\Windows\{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe
        
        C:\Windows\{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2528
      - C:\Windows\{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe
        
        C:\Windows\{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe
        
        C:\Windows\{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe
        
        C:\Windows\{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe
        
        C:\Windows\{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe
        
        C:\Windows\{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe
        
        C:\Windows\{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}.exe
        
        C:\Windows\{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4772
        
        C:\Windows\{9164AB4F-EA76-4020-8950-B47C716E85BF}.exe
        
        C:\Windows\{9164AB4F-EA76-4020-8950-B47C716E85BF}.exe
        13⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A44D8~1.EXE > nul
        13⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BDE2C~1.EXE > nul
        12⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{143B5~1.EXE > nul
        11⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{573FE~1.EXE > nul
        10⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{95B4C~1.EXE > nul
        9⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{91D91~1.EXE > nul
        8⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{831D1~1.EXE > nul
        7⤵
        
        PID:4228
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6C127~1.EXE > nul
        6⤵
        
        PID:368
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0386C~1.EXE > nul
        5⤵
        
        PID:3412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{09FBE~1.EXE > nul
    3⤵
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0386C600-BA9D-4cb1-9F5F-1E11138F60B1}.exe

Filesize
408KB

MD5
f9a2f30bef4ccc703628e68797cdca79

SHA1
a8ea81f675459316b987fe2d4064f42e322bb4f8

SHA256
9fbb87e36e1da9b26690834491785ca66908ae68fc671012bb7a79528d2ea920

SHA512
3350737a4fdf8453725fd5f54b725c10ed5cf2ec282e719b10dfabd332db9c493843ec8fb43502c9fd6779621966c8cc2d0e6a322081637545a109cfee0197f7

Download Submit
C:\Windows\{09FBEBB3-4DB7-4b74-96F0-746F2FB9E0D6}.exe

Filesize
408KB

MD5
b34e22068f0453e11a441a89aa9ac8ca

SHA1
12a225b940f568ed67b05d3c67398db11f63657f

SHA256
9d0dc26b3bb5495ecd225ad6361f86a91219d413d0a288c2fe75a13e27a9ddc3

SHA512
79b68572678fcf512c0d428b0ff26d1ed03292b7b8e34bee920b1113e360bedec066aa135ee2e9bf7af8163e0df9ff5f7293bd5f16d3279ca9afeeeae14d3c2d

Download Submit
C:\Windows\{143B5C2C-272F-461a-B4DE-C10DEDA63CF7}.exe

Filesize
408KB

MD5
c18fce4ddc5b86d757c801486a06ce8d

SHA1
ed55749bc1308488c3f0fb13fa0d04a50b7bf0ce

SHA256
011b1c2d7d165c04112fca2bb487a8d18931ef03b0d3654538c3e1161f76ca88

SHA512
ade08b310f89ef7fd3e201de965b02370f55f8d22d750a8fe1e51a648f06ac0948da7f841f7ebd75ea84702887fce5b6cd9e9e81a1f6f0ab4d8d9771855589c6

Download Submit
C:\Windows\{573FEC55-1887-4673-BBB4-CA89981D4B19}.exe

Filesize
408KB

MD5
7f82cc85312279509058abcda9e7adbf

SHA1
ade131904264c4a788941a117a5fa76d1b91eafb

SHA256
8784f7b214b133034f2428b5eaf7adf42bb863e9c79de920250aa748f61cc369

SHA512
baf88d0eaebfc3de0d4335dcfaa6d42217368ec32f013cc94d7b05483f2b1b3f0bbf5f0845da3d7224d1cccb68c314bcb4d27c1f266e8fc7c79dbae0aab97e9b

Download Submit
C:\Windows\{6C127B07-9B25-4a8a-80C0-722FBE0898F6}.exe

Filesize
408KB

MD5
1c975f01a97a02ccf58d690042f431e4

SHA1
7087bf64a45fa20560d36d8d8efe0aa33fb38891

SHA256
8560cd155e858fb37a71d7a48abfc1d71b67c29811c77779d46c6f8f53856e3d

SHA512
2208b7eecfa81f5e9131db9c6b89d55c50878843d9dad2c1a573cda3d4e086f1ac0ed0f5c0506fa1ba63ff41f1abd46344662d97bb53e142679b6f8ffa68df7d

Download Submit
C:\Windows\{831D1EE0-42E6-4c3f-BE3A-E6B2BF5B0823}.exe

Filesize
408KB

MD5
ae6fc7bd3495ec91778a027d2d09dffc

SHA1
acde03f600be32205c43ff82d47bc2af94054468

SHA256
68a95d0fdcd59ce7108ad622d9bdb570eea07917e27699c1bf3189f6b1ea1f8f

SHA512
dc6bb8f5a49bb40711d728bb9b1bcf1a7021326552167ee07769909c5b86c10365dd51b11c35e0eddfef27afac3ff3db8be2d28695b78ed45ccaa8ea6be9559c

Download Submit
C:\Windows\{9164AB4F-EA76-4020-8950-B47C716E85BF}.exe

Filesize
408KB

MD5
dca98c11a933343013cb0111a9ebe7ad

SHA1
881cacb11cdfe6c1b74a73d80843a511abb79135

SHA256
017be7f7b82f9336aa6a0c0550b540988ae71c120af74d713417fa468ad1c9a7

SHA512
e28a2c1a8c7fd8cf652528d5edeec2f5e51bf7454933a61699149982d3a598698a9db7f04803b31a3f6bad994ca487e21238c566a8abf8c52dbd02a3fabbea71

Download Submit
C:\Windows\{91D913B9-8205-44a7-8FAB-B2AD5C4CF340}.exe

Filesize
408KB

MD5
5a0e0fe750fbf8c4f8d21749fc05da86

SHA1
e79eca3a686f6a917ebb9ca8e805411458a06a88

SHA256
681988910a2858ccc9f5eeea961bec8fa66bcfbd5224d34294802d7e92ef2205

SHA512
173076465eca2708ecad5f2e3a9fc6109e73e0cc20b5a9be91d30c8e61b71646481f090c98d7a6af827bf173cd89f7232ea13f546a66063bf1a963ac64e5866b

Download Submit
C:\Windows\{95B4C7F2-9A06-470f-925D-D3DEE9437C00}.exe

Filesize
408KB

MD5
5af243273544c2cd1c1655cdee48c0a1

SHA1
352107287cf63164995686d2aed9a1e108d7a4ad

SHA256
4c49f5ed028a87a9cef6585941c0334fa92e70094a39569d6c737bb1c9e13d32

SHA512
962355dd69bfa4267ed42c93369b1fa518c6bab69782adb517a173c023dece19d1747a1bb988d119cd201d4bfa0d9c2c4f2168f2ddf1cfdfd94cabeeb19ab278

Download Submit
C:\Windows\{A44D8EE4-145C-4744-BFDF-DEC9B130BB32}.exe

Filesize
408KB

MD5
926fbf0a02a7bcca8291e64c0122ef81

SHA1
eb991589db9e6ce17d8d8cb4ba1fa97977ab7cd5

SHA256
ca41b0d875dbf607d028e0bdde421a73d75c39ffbd643fe330749282e9ac9f57

SHA512
16fffadc4faf30db1f65356a4663c5e03122ec36b13f62ee01de547de68adb1ac416d9b68ccab504ab3065b2fe2661c7114f9d701c02751b35711af2911b0983

Download Submit
C:\Windows\{BDE2C561-62F6-443b-860C-1BFBAA32C4CB}.exe

Filesize
408KB

MD5
cb3ea2b91a33639df23ea810e4ef84b8

SHA1
c7c617cebffb7a02057054f7a02a93f9e15872dc

SHA256
531e66bc2ff89a0f369e8f730c294b35ef980fe40ee3362ff47ffeb516e1077e

SHA512
db19b7461687c56397de42d6e63f01ca1a0120d60e6378b5b56330d991efbdba1859fa7ca27368ade8eec5900cf4c6407cbfacad64a85cd898c12ff8360f8fa2

Download Submit
C:\Windows\{CF95203B-78CC-4363-9AC1-2D3E5371CE12}.exe

Filesize
408KB

MD5
70a85017948a7c41853a9348d22d4e1f

SHA1
12a39ac460229393a9512217c6524380544b4e4d

SHA256
7a169dcac36b71729154b8f816bc7878f79d6c0b778794b5aa8d8124cb6e8792

SHA512
49396e0f358c4bbec4e0578721df8f2c084be354ed303bf72052f89ce7adc2a3d554302e8a95ca93f3ad2f8909cb18b41089329fc0fb97f405f037b7cc72cb65

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads